Skip to main content

LDAP trigger

This section shows you how to set up transparent password synchronization with an LDAP Directory Service trigger system.

Before you begin, ensure you have researched and followed the steps outlined in Implementing Transparent Password Synchronization .

Bravura Pass can intercept password changes on Unix-based LDAP servers using a pre-change and post-change strength filter, psldap* (The actual name of the filter varies depending on the target system type. See the appropriate section for details).

You can install the LDAP password filter plugin (psldap) on the following Unix-based servers:

  • Sun ONE Directory Server (v5.x), Oracle DSEE and Red Hat Directory Server

  • OpenLDAP v2.2.x

  • IBM Directory Server

To set up transparent password synchronization with an LDAP Directory Service trigger system:

  1. Ensure that a compatible version of OpenSSL (3.0.x) is installed on the LDAP system.

  2. Install the LDAP password filter plugin.

  3. Configure the Password Manager (idpm ) service.

  4. Configure your LDAP installation to use the plugin.

  5. Optional: Filter password change requests to include certain users, groups and domains.

These steps are detailed in the following sections.

Warning

Ensure your LDAP client does not hash new passwords before sending requests to the LDAP server. If you do not want passwords to be transmitted in plaintext, enabling SSL on the LDAP server is highly recommended.

In this section: